Security & Risk 28 Oct 2026 1 min read
Neutral · Market-wide Impact · Low Confidence 4/5
Ratings describe the market impact of this story. They are not investment advice.
Bitcoin Wallet Fixes Critical Flaw That Redirected Funds to Attackers
CoinDesk and Decrypt reported: Bitcoin Wallet Fixes Critical Flaw That Redirected Funds to Attackers. The verified details are set out below.
What happened
Bitcoin Wallet Fixes Critical Flaw That Redirected Funds to Attackers. CoinDesk and Decrypt covered the story, and 2 independent publishers are carrying it. This summary is limited to what the cited outlets reported.
Verified points
- Attackers obtained the factory key that proves Keystone's hardware wallets are genuine, and 25,964 buyer records were affected. (Decrypt)
- The company says recovery phrases and private keys were not involved. (Decrypt)
Caveats
Every figure above is attributed to the outlet that reported it. This summary does not forecast prices and is not investment advice.
Sources
- CoinDesk Tier B 27 Oct 2026Crypto wallet maker Keystone to destroy almost 19,000 devices after security breach
- Decrypt Tier B 26 Oct 2026Bitcoin Wallet Fixes Critical Flaw That Redirected Funds to Attackers
- Decrypt Tier B 27 Oct 2026Bitcoin Wallet Maker Keystone Pulls Devices as Stolen Key Opens Door to Fakes
Verified claims
- fact The breach exposed 25,964 buyer records, some retained beyond Keystone's 180-day deletion policy after an automated tool failed unnoticed.Source: CoinDesk
- fact Attackers obtained the factory key used to prove Keystone hardware wallets are genuine.Source: Decrypt
- fact Keystone says recovery phrases and private keys were not involved in the security breach.Source: Decrypt
- fact A confirmed exploit let rogue servers replace Electrum's pending transactions, tricking users into redirecting Bitcoin to attacker addresses.Source: Decrypt
- fact Attackers obtained the factory key that proves Keystone's hardware wallets are genuine, and 25,964 buyer records were affected.Source: Decrypt
- fact The company says recovery phrases and private keys were not involved.Source: Decrypt